I'm pretty sure you need `Access-Control-Allow-Methods` as well or it will get rejected by the browser. I wrote one for SUMO:

https://github.com/mozilla/kitsune/blob/dc95ade0c4701e4f329bde3c353aa6bbd6a19206/kitsune/sumo/decorators.py#L71

Maybe that can be reused here.